{"id":"ECHO-1fcb-1955-3c69","summary":"NULL pointer write in the wget applet's -T/--timeout handling\n(networking/wget.c): getopt32() is handed NULL as the -T storage only when\nbusybox is built with CONFIG_WGET but WITHOUT CONFIG_FEATURE_WGET_TIMEOUT\n(\"IF_NOT_FEATURE_WGET_TIMEOUT(NULL)\"). Every busybox Echo ships is built\nfrom Debian's own configs, where that combination never occurs:\ndebian/config/pkg/deb and debian/config/pkg/static (busybox,\nbusybox-static, busybox-syslogd, udhcpc, udhcpd) set\nCONFIG_FEATURE_WGET_TIMEOUT=y, so -T is stored in G.timeout_seconds, and\ndebian/config/pkg/udeb does not build wget at all. Verified on 1:1.38.0-3:\na build from debian/config/pkg/deb and Debian's busybox and busybox-static\nbinaries answer \"wget -T 5\" and \"wget --timeout 5\" normally, while the same\ntree with only FEATURE_WGET_TIMEOUT turned off segfaults on \"wget -T 5\".\nThe cited \"patch\" 83a40bf is a commit in a third-party fork, not in\nupstream busybox, and bundles unrelated applet changes. Debian rates the\nCVE unimportant (\"crash in CLI tool, no security impact\").\n","modified":"2026-10-16T13:15:03.125108960Z","published":"2026-08-19T22:59:36.669Z","withdrawn":"2026-10-16T12:30:03.875Z","upstream":["CVE-2026-76014"],"references":[{"type":"WEB","url":"https://advisory.echohq.com/cve/CVE-2026-76014"},{"type":"WEB","url":"https://advisory.echohq.com/cve/CVE-2026-76014"}],"affected":[{"package":{"name":"busybox","ecosystem":"Echo","purl":"pkg:deb/echo/busybox"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.38.0-3+e1"}]}],"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-1fcb-1955-3c69.json"}}],"schema_version":"1.9.0"}